Keep build-tree details out of native gems

[excid3]

Found by deploying fresh Rails apps (3.2 to 8.0) on the published builds of every series. All 17 deploys passed, but three things leak from the build into gems compiled on the server.

1. Gems that build but can't load (static libruby)

gem install strscan -v 3.1.8 on 2.4.10, 2.5.9, 2.6.10 and 2.7.8:

symbol lookup error: .../strscan.so: undefined symbol: rb_deprecate_constant

mkmf links have_func probes against libruby-static.a, where Ruby's internal (hidden-visibility) functions are ordinary linkable globals. The probe succeeds, the gem calls the function, and the ruby executable doesn't export it. A fresh bundle of Rails 6.1 on 2.5.9 hits this through mail -> net-imap -> strscan.

Fix: after install, merge the archive into a single relocatable object and objcopy --localize-hidden it. Only the exported API stays linkable, as with a shared libruby.

2. Build paths in rbconfig and run paths

• LDFLAGS/DLDFLAGS carried -Wl,-rpath,/work/.build/.../deps/ncurses/lib (-Wl,-R on older series), which went into every native gem.
• configure_args kept --with-openssl-dir=/work/.build/... etc., which mkmf's dir_config turns into -I/-L/run path for gems such as puma. They now point at the relocated prefix, where those headers and static libraries actually are.
• The shipped ruby and extensions had the same run paths; removed with patchelf (present in the manylinux images).

3. terminfo

The bundled ncurses searched a terminfo database under the build directory: Cannot read termcap database; using dumb terminal settings. on every readline load. It now reads /etc/terminfo:/lib/terminfo:/usr/share/terminfo.

Checks

check_no_build_paths! fails the build if rbconfig or any binary's run path names the build's dependency tree or install prefix, or if libruby-static.a still has global hidden symbols.

Testing

Built locally for arm64: 1.8.7-p374, 2.1.10, 2.5.9, 2.7.8, 3.1.7 (no YJIT) and 3.2.0, 3.4.11, 4.0.7 (YJIT). On Ubuntu 24.04 with each:

• no termcap warning, readline loads; no /work/ in rbconfig; no run path on shipped binaries
• strscan 3.1.8 compiles and loads (2.5.9 and later)
• puma compiles against the bundled OpenSSL via the rewritten --with-openssl-dir, no dynamic libssl dependency, no exported SSL symbols
• pg from source + TLS Postgres + HTTPS in both require orders: all eight pass

Not changed (same in the published builds): 4.0.7's bin/ruby has an /./lib RPATH and rbconfig keeps a RUST_LIB makefile variable pointing at the build tree.

After merge

libexec/package.rb is in every fingerprint, and this one does change every build: dispatch Release New Versions with replace_all.